Elastic high stable eql

MySQL User-Defined Function Injection

Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient database privileges can place a malicious library in the MySQL plugin directory and register it with "CREATE FUNCTION ... SONAME", establishing a database-resident primitive for operating-system command execution.

View Source

Detection Logic

any where data_stream.dataset == "network_traffic.mysql" and
    network_traffic.mysql.query like~ "*create*function*soname*"

False Positives

  • ⚠ Database administrators may install approved native MySQL user-defined functions during planned maintenance. Validate the function and library names, the client address, the maintenance window, and whether the shared library was supplied through an approved software deployment process.

Field Validations

Loading…

Comments (0)

Loading comments...